On April 4, Governor Andy Beshear signed into law HB 15 becoming the 15th state to enact comprehensive consumer data privacy legislation. The new Kentucky Consumer Data Protection Act (KCDPA) largely tracks the Virginia’s law but without this year’s amendments relating to children’s data. For agencies already complying with other non-California privacy laws, the Kentucky bill will not require any additional compliance burdens. Kentucky’s legislation uses Connecticut’s more consumer-friendly definition of biometric data, which states that a video or audio recording or data generated is not biometric data unless it is used to identify a specific individual. KCDPA applies to persons that, during the prior calendar year either controlled or processed the personal data of at least 100,000 consumers or 2.22% of state’s 4.5 million population and derives over 50% of gross revenue from sale, control or processing of personal data for at least 25,000 consumers. The KCDPA becomes effective on January 1, 2026 and is enforceable by the Kentucky Attorney General’s office. There is no private right of action.

...